KR20160110276A - Method and apparatus for generating Dynamic Secure Module - Google Patents

Abstract

The present invention relates to a method for generating dynamic security module to be allocated to a user terminal such that codes performed for security in the user terminal are all different whenever performed. The method for generating dynamic security module comprises a step of assigning a part or a whole of a changeable part of codes configuring the dynamic security module as variables, and allocating a regular value to at least one of the variables, wherein a part or a whole of the codes configuring the dynamic security module transmitted to the user terminal has an effective time. According to the present invention, by transmitting the dynamic security module of which a part or a whole of the codes performing security management has a regular effective time, to a security client of the user terminal, a security module with respect to various types of application programs of the user terminal is frequently updated, whereby it is hard to hack the application programs. Therefore, security of the user terminal can be dynamically improved.

Description

TECHNICAL FIELD [0001] The present invention relates to a method and a device for generating a dynamic security module,

The present invention relates to an apparatus and method for generating a dynamic security module, and more particularly, to a dynamic security module in which a part or all of a source code for performing security management has a certain effective time, A dynamic security module generation method and a dynamic security module generation method capable of remarkably improving the security of the user terminal by making the security module for various application programs of the user terminal updated from time to time, ≪ / RTI >

In recent years, smart phones, which are mobile terminals, have become indispensable to modern life and are becoming widespread throughout the world. However, as smartphone security vulnerabilities continue to be detected, attacks from malicious applications are increasing rapidly.

Hackers develop malicious applications for mobile terminals, insert malicious code, and distribute them to ordinary users by pretending to be normal applications through open markets or the Internet. When a malicious application is stored in a mobile terminal, the malicious application in the mobile terminal may send financial information such as SMS transmission / reception information, a phone book, an Internet access record, The attacker may attempt to attack the vehicle.

Most application security solutions communicate with the security module of the application when the application is executed, invoke the security logic, and respond to the results. However, if the communication with the security module is forcibly blocked or tampered with by the attack of hackers, if the security module is disabled, personal information related to personal information and financial information will be fatal.

Therefore, there is a great need for technology development that can solve the security weakness problem and enhance the security of various software included in the user terminal in a mobile terminal based user environment, which has been widely used in domestic and foreign countries recently.

Korean Patent Publication No. 10-2013-0101657 (Publication date 2013.09.16)

It is an object of the present invention to provide a dynamic security module, in which a part or all of a source code for performing security management has a certain effective time, and transmits the generated dynamic security module to a security client of a user terminal A dynamic security module generation method and a dynamic security module generation method capable of remarkably improving the security of the user terminal by making the security module for various application programs of the user terminal updated from time to time, Device.

According to another aspect of the present invention, there is provided a method of generating a dynamic security module, the dynamic security module being allocated to a user terminal so that code executed for security in a user terminal is not identical every time, A step of allocating a certain value to at least one of the variables in which a part or all of the changeable part of the code configuring the security module is designated as a variable and configuring a dynamic security module transmitted to the user terminal Some or all of the code has a valid time.

The modifiable portion of the dynamic security module includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an execution code obfuscation method It can be a code that can change one or more selected elements.

The validity time may be a validity time such that part or all of the code is deleted or not used at the expiration of the validity time.

The generating method may further include generating a secure session with the security client of the user terminal and transmitting the dynamic security module to the security client of the user terminal in which the secure session is generated.

The generating method further includes receiving a security management result from the dynamic security module transmitted to the security client, checking the received security management result, and transmitting the security management confirmation result value to the dynamic security module of the security client .

The generating method may further include transmitting a stop command to the dynamic security module of the secure client to stop the application program of the user terminal when a security problem occurs in the user terminal.

The generating method may generate and store a session ID as a secure session identifier, and send the session ID to the secure client so that the secure client stores the session ID, thereby generating the secure session.

The generating method may further include storing parameters for each of the dynamic security modules transmitted to the secure client while the secure session is maintained.

The generation method may further include verifying that the history transmitted from the security client is identical to the configuration of the parameters of the dynamic security module.

In order to achieve the above object, the present invention also provides a device for generating a dynamic security module to be allocated to a user terminal so that code executed for security in a user terminal is not the same every time, And a processor for controlling the communication unit, wherein the processor is configured such that a part or all of the changeable part of the code constituting the dynamic security module is designated as a variable, and at least one of the variables has a constant value And a dynamic security module generation device for causing a part or all of the codes constituting the dynamic security module transmitted to the user terminal to have a valid time.

The modifiable portion of the dynamic security module includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an execution code obfuscation method It can be a code that can change one or more selected elements.

The processor may further comprise generating a security session with the security client of the user terminal and transmitting the dynamic security module to the security client of the user terminal from which the secure session is generated.

The processor may further include receiving a security management result from the dynamic security module transmitted to the security client, checking the received security management result, and transmitting the security management confirmation result value to the dynamic security module of the security client .

The processor may further include, when a security problem occurs in the user terminal, transmitting a stop command to the dynamic security module of the secure client to stop the application program of the user terminal.

The processor may generate and store a session ID as a secure session identifier and send the session ID to the secure client so that the secure client stores the session ID, thereby creating the secure session.

The processor may further comprise storing parameters for each of the dynamic security modules transmitted to the secure client while the secure session is maintained.

The processor may further include verifying that the history transmitted from the security client is the same as the configuration of the parameters of the dynamic security module.

The dynamic security module generation apparatus may further include a dynamic security module to be transmitted to the security client of the user terminal, a session ID as a security session identifier, and a storage for storing parameters for the dynamic security module.

The present invention also provides a computer-readable recording medium on which a program for executing the dynamic security module creation method is recorded.

The dynamic security module generating method and the generating apparatus according to the present invention generate a dynamic security module in which a part or all of the source code for performing security management has a certain effective time and transmit the generated dynamic security module to the security client of the user terminal, The security module for the programs is updated frequently so that the hacking of the application programs becomes difficult and the security of the user terminal can be remarkably improved.

1 is a block diagram illustrating a procedure of a method for generating a dynamic security module according to a first and a second example of the present invention.
FIG. 2 is a block diagram showing a procedure of a method for generating a dynamic security module according to a second example of the present invention.
3 is a schematic diagram showing a schematic configuration of an apparatus for generating a dynamic security module according to the present invention.
4 is a schematic diagram illustrating an example of dynamic code generation with different functions in a dynamic security module generation method according to an embodiment of the present invention.
FIG. 5 is a schematic diagram illustrating an example of generating a dynamic algorithm composed of different algorithms in the dynamic security module creation method according to an embodiment of the present invention.
6 is a schematic diagram illustrating an example of dynamic compilation parameter generation having different compile levels in the dynamic security module generation method according to an embodiment of the present invention.
7 is a schematic diagram illustrating an example of generating a session ID and a dynamic security module parameter in the dynamic security module creation method according to an embodiment of the present invention.
8 is a schematic diagram illustrating an example of generating a dynamic security module protocol field in the method of generating a dynamic security module according to an embodiment of the present invention.
9 is a schematic diagram illustrating an example of generating a dynamic security module protocol sequence in the method of generating a dynamic security module according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. In the following description of the embodiments of the present invention, specific values are only examples.

FIG. 1 is a block diagram showing a procedure of a method for generating a dynamic security module according to a first exemplary embodiment of the present invention. FIG. 2 is a block diagram illustrating a procedure of a method for generating a dynamic security module according to a second exemplary embodiment of the present invention Respectively.

Referring to these drawings, a method for generating a dynamic security module according to a first embodiment of the present invention includes a method for generating a dynamic security module allocated to the user terminal so that code executed for security in a user terminal is not identical every time (S100) of allocating a constant value to at least one of the variables, wherein a part or all of the changeable part of the code configuring the dynamic security module is designated as a variable, and the step And generating and storing the dynamic security module so that a part or all of the codes constituting the transmitted dynamic security module have a valid time (S110).

That is, in the dynamic security module creation method according to the present invention, in the dynamic security module in which a part or all of the changeable part of the code configuring the dynamic security module is designated as a variable, a certain value is assigned to at least one of the variables The codes for performing security management in the security client of the user terminal are dynamically and randomly selected so that it is very difficult to hack the dynamic security module by the hacker. Therefore, the security of the user terminal equipped with the dynamic security module Can be remarkably improved.

Also, there is an advantage that different dynamic security modules having numerous kinds of code configurations can be generated by making code configurations of the dynamic security modules frequently updated in the security client of the user terminal and performing security management different from each other.

Specifically, a code assigned to a part or all of the changeable part of the code for each function for performing security management to the security client of the user terminal is used, and a predetermined value is assigned to at least one of the variables Steps, so that a myriad of types of dynamic security modules can be created.

For example, we use a code that specifies some (r) or all (n) of the mutable codes of the dynamic security module as variables, so we can create and use a number of mutable code combinations (nCr) have.

Where r is (n > = r)

In addition, when a certain value is assigned to a code designated by a variable by using various kinds of codes (a) for the changeable codes stored in the device for performing the method of generating the dynamic security module, b) can be made of the following combinations (aCb).

Where b is (a > = b)

Therefore, the dynamic security module generation method is characterized in that a large number of codes can be generated for security in a user terminal.

In addition, since the dynamic security module is configured such that some or all of the codes constituting the dynamic security module transmitted to the user terminal have a valid time, the dynamic security module transmitted to the security client of the user terminal is frequently updated , Security problems with respect to application programs installed in a user terminal due to hacking of a security module, infection of a computer virus, and the like can be effectively prevented.

Variable portions of the dynamic security module include, for example, a function name of a code, a variable specifying an algorithm to be executed, a protocol field, a variable specifying a protocol sequence, a variable specifying a compile level, and a variable specifying an execution code obfuscation method And a code that can change at least one element selected from the group consisting of < RTI ID = 0.0 >

That is, even when the dynamic security module is newly updated, such as codes for implementing a driving start point, among the codes constituting the dynamic security module driven for security management in the security client of the user terminal, Except for the changeable code, the changeable code includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable specifying a compile level, and a variable designating a method of obfuscating an execution code It is possible to create a myriad of types of dynamic security modules by modifying the above elements.

Herein, the protocol field is a protocol such as a method of performing various items of security management performed by the dynamic security module in the security client. For example, the protocol field may be a hacking threat to an application program including the security client A communication protocol for transmitting a result of determining whether an element exists, a file protocol for the application program, a boot & file virus, and the like.

In addition, the protocol sequence refers to the order of execution of various items including the security management performed by the dynamic security module 118 in the security client. For example, the protocol sequence may include an O / S Hacking threats consisting of forgery, app tampering, rooting, debugger, history of root process execution, installation of harmful applications, history of harmful application execution, malicious port, forgery, input value forgery and computer virus In the detection of the possible elements, it may be the order of detecting the respective elements.

In addition, when the source code of the dynamic security module is built as a machine language executable in the security client, the compile level is optimized and compiled using a compiler for smooth security management function execution. In this case, various levels of codes can be generated in addition to the optimization level of the code, and various different types of dynamic security modules can be created by implementing different compile levels of the code constituting the dynamic security module. In addition, implementation of different compile levels of the source code may be implemented not only in the server device for generating the dynamic security module but also in the security client of the user terminal.

Also, the effective time of part or all of the code for performing the security management of the dynamic security module is, for example, 1 hour, 3 hours, 6 hours, 9 hours, 12 hours, 24 hours, 48 hours and 72 hours And the code may be partially or entirely deleted or not used at the time when the effective time has elapsed. Accordingly, at the expiration of the expiration time of the dynamic security module, the security client suspends the use of the dynamic security module and updates and receives a new dynamic security module from the dynamic security module server device, The occurrence of a security problem of the user terminal due to the virus infection can be effectively prevented.

A method for generating a dynamic security module according to a second embodiment of the present invention is a method for generating a dynamic security module to be allocated to a user terminal so that code executed for security in a user terminal is not identical every time, And a dynamic security module transmitted to the user terminal, the dynamic security module being configured such that a part or all of the changeable part of the code configuring the module is designated as a variable and a constant value is assigned to at least one of the variables, (210) of generating a security session with a security client of the user terminal so that all or part of the code constituting the security session has a valid time, and transmitting the dynamic security module to a security client of the user terminal (Step 220).

That is, in the method of generating a dynamic security module according to the second embodiment of the present invention, a dynamic security module is generated so that a part or all of security management code in a security client of a user terminal has a certain effective time, At the time of driving the application program including the security client at the user terminal, at the user's request of the user terminal, at the predetermined period set at the dynamic security module server device, The dynamic security module is frequently updated by transmitting the dynamic security module to the security client of the user terminal so that a hacking of the security module or a computer virus To the user terminal due to infection etc. There is a feature that can more effectively prevent the occurrence of a security problem with the loaded application programs.

The method may further include receiving (230) a security management result from the dynamic security module transmitted to the security client, checking (240) whether a security problem has occurred by checking the received security management result, If the security problem does not occur in the terminal, a security management confirmation result value indicating that the security problem does not occur is transmitted to the dynamic security module of the security client (S250).

Here, if a security problem occurs in the user terminal, a step S251 of transmitting a security management confirmation result value indicating that a security problem has occurred to the dynamic security module of the security client is performed.

In addition, if a security problem occurs in the user terminal, step S252 may be further performed to transmit a stop command to stop the application program of the user terminal to the dynamic security module of the secure client.

That is, in the method of generating a dynamic security module according to the present invention, a security management result received from a dynamic security module transmitted to a security client of a user terminal is received and confirmed, and the result of the security management confirmation is transmitted to the dynamic security module, The security module can quickly and effectively cope with a security problem of the user terminal.

In this regard, a security management result is received from the dynamic security module transmitted to the security client as the security management, and the received security management result is checked. When a security problem occurs in the user terminal, Further comprising transmitting a stop command to stop the program to the dynamic security module of the secure client and discarding the secure session with the secure client so that the hacker hackes the dynamic security module, It is possible to fundamentally prevent the problem of generating a security problem with respect to the user.

That is, when the security problem of the user terminal occurs, the application program loaded on the user terminal is quickly stopped, thereby preventing an additional security problem with respect to other application programs loaded on the user terminal by driving the application program. The security session can be discarded and the tracking and analysis of the dynamic security module or the dynamic security module server device by the hacker can be quickly blocked.

Here, the security management may include detecting whether the dynamic security module has an element that may be a hacking threat to the application program including the security client, O / S forgery of the terminal in which the application program is installed, Which can be a threat of forgery consisting of forgery and falsification of an application (App), rooting, debugger, history of root process execution, installation of harmful applications, history of harmful application execution, Detecting an element, transmitting information about an element that may be a threat of hacking to the dynamic security module server device, treating the virus for the application program, threatening hacking for the application program and virus infection Sending a stop command for the application program to prevent a problem, The overall security of the dynamic security module performed by the dynamic security module for the security of the user terminal due to the expiration of the effective time of the dynamic security module, the hacking by the hacker, the virus infection, or the like, .

Also, the security management event received from the user terminal may include, for example, a description for determining a parameter for the dynamic security module transmitted from the security client, a state description about a state in which the dynamic security module is running, Security management result information indicating that a hacking threat has occurred, and a virus treatment history for an application program installed in the user terminal.

Also, the security management result is a result of security management performed by the dynamic security module in the security client, and is a result value of performing detailed security management functions included in the dynamic security module. to be. For example, as a result of detection of existence of an element that may be a threat of hacking, a detection result of an element that may be a threat of hacking, a virus treatment for the application program, and a removal result And the like.

In addition, the security management confirmation result value is a result of determining whether a security problem has occurred in the user terminal, which has received the security management result by the dynamic security module server device and analyzed based on the security management result. That is, as a result of the determination as to whether there is an element that may present a hacking threat to the user terminal, a result of the determination as to whether or not the application program loaded on the user terminal is hacked and the result of the determination that the application program is infected with a virus or a malicious code As shown in FIG.

The dynamic security module may generate a secure session by generating and storing a session ID as a secure session identifier, and transmitting the session ID to the secure client so that the secure client stores the session ID. A method for creating a secure session using the session ID includes generating a plurality of security sessions to frequently update a secure session, thereby improving the reliability and convenience of security management for the user terminal by the dynamic security module .

Here, the security session may be generated by a security client of the authenticated user terminal. That is, the security session may be further authenticated to the security client of the user terminal for transmitting the dynamic security module so that the security of the user terminal can be further improved.

Also, the authentication of the security client of the user terminal may be performed, for example, after the application, which is an application program including the security client, is installed in the user terminal and authentication is completed, or after the application is installed in the user terminal, Upon completion of authentication upon activation or upon completion of authentication upon log in and log out of the application or after the application is installed on the user terminal, Authentication can be completed.

The generating method may further include storing parameters for each of the dynamic security modules transmitted to the secure client while the secure session is maintained.

Here, the parameters for the dynamic security module are a function name of a code for performing security management of a dynamic security module transmitted to the security client and performing security management, a variable designating a algorithm to be executed, a protocol field, and a protocol sequence Variable, a variable for specifying a compile level, and a variable for designating an obfuscation method of an executable code, and is for distinguishing each dynamic security module that is frequently updated and has a different configuration from each other, Information determined at the server device, information at the time of execution of code for performing security management of the dynamic security module.

The processor may further receive the details of the dynamic security modules transmitted to the security client and verify whether the dynamic security modules are the same as the configuration of the parameters of the stored dynamic security module. The verification of the change of the parameter of the dynamic security module may be performed, for example, when the parameters of the dynamic security modules, in which each parameter is sequentially transmitted as ABCD, are not the same as the details transmitted from the security client, If it is confirmed, it can be inferred that there is a hacking attempt by the hacker, and the countermeasure can be performed.

3 is a schematic diagram showing a schematic configuration of an apparatus for generating a dynamic security module according to the present invention.

3, an apparatus 310 for generating a dynamic security module according to the present invention includes a dynamic security module (e.g., a dynamic security module) 310 allocated to the user terminal 350 so that the code executed for security in the user terminal 350 may not be the same 318) comprising a communication unit (312) for sending and receiving a security management event via a network and a processor (314) for controlling said communication unit (312), said processor (314) The dynamic security module 318, which is assigned to the user terminal 350, assigns a certain value to at least one of the variables, Some or all of the codes constituting the program may have a valid time.

That is, the dynamic security module generation apparatus 310 according to the present invention is a system in which a part or all of the code that the processor 314 performs security management in the security client 352 of the user terminal 350 is a dynamic security Modules 318 may be stored or generated on each transmission so that upon activation of the user terminal 350 or upon activation of an application program including the security client 352 at the user terminal 350, The security client 352 of the user terminal 350 may access the dynamic client module 350 at various times such as at a user request of the dynamic security module server device 310 or at a predetermined period set at the user terminal 350, And sends the dynamic security module 318 to the security client 352 of the user terminal 350 so that the dynamic security module 318 may frequently send a gang So to has a feature that can help prevent security problems for an application installed on the user terminal due to such security module hacking or computer virus infection effectively.

Variable portions of the dynamic security module include, for example, a function name of a code, a variable specifying an algorithm to be executed, a protocol field, a variable specifying a protocol sequence, a variable specifying a compile level, and a variable specifying an execution code obfuscation method And a code that can change at least one element selected from the group consisting of < RTI ID = 0.0 >

That is, even when the dynamic security module is newly updated, such as codes for implementing a driving start point, among the codes constituting the dynamic security module driven for security management in the security client of the user terminal, Except for the changeable code, the changeable code includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable specifying a compile level, and a variable designating a method of obfuscating an execution code It is possible to create a myriad of types of dynamic security modules by modifying the above elements.

The security management event received from the user terminal 350 may be, for example, a history for determining parameters for the dynamic security module 318 transmitted from the security client 352, a dynamic security module 318 Such as a state state of a state where a hacking threat exists, security management result information indicating that a hacking threat exists, and a virus treatment history for an application program installed in the user terminal 150. [

In addition, the user terminal 350 may be various terminal devices requiring security such as a smart phone, a tablet PC, a desk top computer, a notebook computer, and the like.

The processor 314 receives the security management result from the dynamic security module 318 transmitted to the security client 152 and verifies the received security management result and transmits the security management result to the security client 352 To the dynamic security module 318 of the mobile device.

Specifically, a security management result is received as the security management from the dynamic security module 318 transmitted to the security client 352, and the received security management result is checked to determine whether a security problem exists in the user terminal 350 And sending the security diagnosis confirmation result value indicating that no security problem has occurred to the dynamic security module 318 of the security client 352 if the authentication result is not generated.

The dynamic security module 318 receives the security management result as the security management from the dynamic security module 318 transmitted to the security client 352 and checks the received security management result to determine whether a security problem has occurred in the user terminal 350 , And sending the security management confirmation result value to the dynamic security module 318 of the security client 352 indicating that a security problem has occurred.

That is, the dynamic security module generation apparatus 310 according to the present invention receives and confirms the security management result from the dynamic security module 318 transmitted to the security client 352 of the user terminal 350, Value to the dynamic security module 318 so that the dynamic security module 318 can quickly and effectively respond to a security problem of the user terminal 150. [

In this regard, the processor 314 receives the security management result as the security management from the dynamic security module 318 transmitted to the security client 352, confirms the received security management result, To the dynamic security module 118 of the secure client 352 a stop command to stop the application program of the user terminal 350 when a security problem occurs in the secure client 352, The hacker can hack the dynamic security module 318 and fundamentally prevent the problem of generating a security problem for various application programs of the user terminal 350. [

Meanwhile, the processor 314 generates and stores a session ID 316 as a secure session identifier, and transmits the session ID 316 to the secure client 352 so that the secure client 352 transmits the session ID 316), thereby creating a secure session. A method for generating a secure session using the session ID includes generating a plurality of secure sessions and updating the secure session frequently so that the reliability and convenience of security management for the user terminal 350 by the dynamic security module 318 There is an advantage that it can be improved.

The validity time may be a validity time such that part or all of the code is deleted or not used at the expiration of the validity time. That is, the dynamic security module 318, which has a part or all of the code for performing security management in the security client 352 of the user terminal 350 has a valid time, Or the use of the dynamic security module itself may be suspended so as not to perform security management.

Thus, upon expiration of the expiration time of the dynamic security module 318, the security client 352 updates some or all of the code that constitutes the dynamic security module 318, thereby preventing the hacking of the dynamic security module 318 It is possible to prevent the occurrence of a security problem caused by a virus infection or the like.

The processor 314 may further include storing parameters for each of the dynamic security modules 318 sent to the secure client 352 while the secure session is maintained.

Here, the parameters for the dynamic security module 318 are transmitted to the security client 352 so that the function structure of the code for performing the security management of the dynamic security module performing the security management, the type of the algorithm, The dynamic security module server device 310 is configured to divide each of the dynamic security modules that are frequently updated and have different configurations from each other, Is changed.

The processor 314 receives the details of the dynamic security modules 318 transmitted to the security client 352 and verifies whether or not the configuration of the dynamic security module 318 is the same as the configuration of the stored dynamic security module 318 . The verification of the change of the parameters of the dynamic security module is not the same as that of the parameters transmitted from the security client 352, for example, when the parameters of the dynamic security modules, in which each parameter is sequentially transmitted as ABCD, If it is confirmed that the change has been made differently, it can be inferred that there is an attempt of hacking by the hacker, and the countermeasure can be performed.

The dynamic security module generation apparatus 310 stores a dynamic security module 318 to be transmitted to the security client 352 of the user terminal 350, a session ID 316 as a secure session identifier, and parameters for the dynamic security module And a storage unit 313 for storing data.

That is, the dynamic security module server apparatus 310 stores the dynamic security module 318 and the session ID 316 in the storage 313, thereby smoothly connecting the dynamic security module 318 and the session ID 316 The secure client 352 can be reliably transmitted. In addition, by storing the parameter for the dynamic security module transmitted to the security client 352 in the storage 313, it is possible to verify the identity with the reception history of the dynamic security module 318 transmitted to the security client 352 Can be performed more stably.

FIG. 4 is a schematic diagram illustrating a dynamic source code generation example in which a dynamic security module generation method according to an exemplary embodiment of the present invention includes different functions. FIG. 5 is a flowchart illustrating a dynamic security module creation process according to an exemplary embodiment of the present invention. FIG. 6 is a schematic diagram illustrating an example of dynamic creation of dynamic compilation parameters having different compile levels in the dynamic security module creation method according to an embodiment of the present invention. Are shown.

Referring to these drawings, a dynamic security module generation method and a dynamic security method according to an exemplary embodiment of the present invention may include an IP address (Internet Protocol address) of a user terminal received upon authentication of a security client, Number, and a value generated from a random number generator, various different types of dynamic security modules can be generated.

First, the dynamic security module according to the dynamic security module creation method according to the present invention generates logic for generating a security diagnosis execution result in the security client, every time the dynamic security source code generation example (lower part of FIG. 4) It can be implemented as source code with different functions to be changed.

In the case of the conventional general source code, since the specific function name corresponding to the source code is immediately exposed at the time of analysis of the source code, as shown in the creation example of FIG. 4 (upper part of FIG. 4) It is very easy to grasp. However, the dynamic security module according to the present invention has a probability (%) that the source code constituting the main logic is not determined but the source code composed of the random string is adopted as in the creation example (the lower part of FIG. 4) ), It is configured so that it is very difficult for the hacker to easily grasp the main logic of the dynamic security module. Such dynamic source code can be easily implemented using, for example, a template framework.

In addition, the dynamic security module according to the present invention implements logic that performs the same security management function as, for example, three different algorithms as in the dynamic algorithm generation example of the dynamic security module of FIG. 5, By configuring the algorithm to be selected as an algorithm for performing security management, it is possible to hack the dynamic security module itself very difficult by requiring the hacker to request different algorithm analysis each time.

In addition, the dynamic security module according to the present invention generates various levels of compilation results in addition to the optimization level compilation result in the dynamic security module building process as in the dynamic compilation parameter generation example of FIG. 6, Code configuration can be implemented differently each time.

FIG. 7 is a schematic diagram illustrating an example of generating a session ID and a dynamic security module parameter in the dynamic security module creation method according to an embodiment of the present invention. FIG. 8 is a flowchart illustrating a method of generating a dynamic security module according to an embodiment of the present invention FIG. 9 is a schematic diagram illustrating an example of generating a dynamic security module protocol sequence in the method for generating a dynamic security module according to an embodiment of the present invention.

Referring to these drawings, a method for generating a dynamic security module according to the present invention generates a session ID as a secure session identifier, such as in the session ID and dynamic security module parameter creation example of FIG. 7, And send the session ID to the secure client so that the secure client stores the session ID, thereby creating a secure session. Also, parameters for the dynamic security module generated while the security session is maintained can be stored.

7, when the dynamic security module server device and the security client of the user terminal generate 11836381 as a session ID to create a secure session, And the security module is created by verifying that the parameter param is A, B, C and the state at this time is 1, 2, and 72365784 is generated as the session ID, (C), B, and A, and verify that the state at this time is 0, 3. If a security session is created by generating 87656501 as a session ID, Details of the dynamic security module transmitted from the security client This parameter can be verified as B, A, C, and the state at this time is 3, 2 have. Here, these parameters and the state details may be security management events received from the user terminal.

It is also possible to configure the hacker to make the analysis on the dynamic security module more difficult by setting the modification time interval of each security session and the transmission time interval of the dynamic security module for each security session different for each security session There is also.

The method for generating a dynamic security module according to the present invention may also be configured such that protocol fields (brown, white, black) with a security client are generated for each generated dynamic security module, And transmit it to the security client of the user terminal.

If the protocol field of the dynamic security module transmitted to the security client is different every time, the hacker becomes more difficult to hack the dynamic security module because the hacker must analyze each different protocol field every time.

Also, the dynamic security module generation system according to the present invention may be configured such that the protocol sequence (A- > B- > C-> D) of the dynamic security module executed in the security client is generated as in the dynamic security module protocol sequence generation example of Fig. For each dynamic security module that is created, for example, it is set differently from A-> D-> B-> C, D-> C-> B-> A, B-> A-> D-> C, So that the driving sequence of the detailed functions for performing security management can be implemented differently each time, thereby making it possible to configure a dynamic security module which is more difficult to hack.

The dynamic security module generation apparatus 110 according to the present invention includes a processor 314, a communication unit 312, and a storage 313.

The processor 314 may generate a control signal to control the generating device 310 including the communication unit 312 and the storage 313. [ Here, the communication unit 312 can communicate with an external device by using various protocols to transmit and receive data, and can exchange digital data such as contents and applications by connecting to an external network by wire or wirelessly.

The storage 313 is a device capable of storing various digital data including audio, pictures, moving pictures, applications, and the like. The storage 313 stores various digital data such as a flash memory, a random access memory (RAM) Indicates storage space. Such storage 113 may temporarily store the data received from the external device via the communication unit 312. [

The method of generating a dynamic security module according to the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software.

As described above, the present invention has been described with reference to particular embodiments, such as specific elements, and specific embodiments and drawings. However, it should be understood that the present invention is not limited to the above- And various modifications and changes may be made thereto by those skilled in the art to which the present invention pertains.

Accordingly, the spirit of the present invention should not be construed as being limited to the embodiments described, and all of the equivalents or equivalents of the claims, as well as the following claims, belong to the scope of the present invention .

Claims (19)

A method for generating a dynamic security module, the dynamic security module being assigned to a user terminal so that code executed for security in the user terminal is not identical every time,
A part or all of the changeable part of the code constituting the dynamic security module is designated as a variable,
And allocating a predetermined value to at least one of the variables, wherein a part or all of the codes constituting the dynamic security module transmitted to the user terminal have a valid time.
The method according to claim 1,
The modifiable portion of the dynamic security module includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an execution code obfuscation method A method of generating a dynamic security module, the code being able to modify one or more selected elements.
The method according to claim 1,
Wherein the validity time is a validity time at which a part or all of the code is deleted or not used at the expiration of the validity time.
The method according to claim 1,
The above-
Creating a secure session with a security client of the user terminal; And
Transmitting the dynamic security module to a security client of a user terminal in which the secure session is created;
Further comprising the steps of:
5. The method of claim 4,
The above-
Further comprising: receiving a security management result from the dynamic security module transmitted to the security client, checking the received security management result, and transmitting a security management confirmation result value to the dynamic security module of the security client How to create a module.
5. The method of claim 4,
The above-
And sending a stop command to the dynamic security module of the secure client to stop the application program of the user terminal when a security problem occurs in the user terminal.
5. The method of claim 4,
The above-
Generating a session ID as a secure session identifier, storing the session ID, and transmitting the session ID to the secure client so that the secure client stores the session ID, thereby generating the secure session.
5. The method of claim 4,
The above-
Further comprising: storing parameters for each dynamic security module transmitted to the secure client while the secure session is maintained.
9. The method of claim 8,
The above-
Further comprising verifying whether the history transmitted from the security client is the same as the configuration of the parameters of the dynamic security module.
An apparatus for generating a dynamic security module to be allocated to a user terminal so that code executed for security in a user terminal is not identical every time,
A communication unit for sending and receiving a security management event via the network; And
A processor for controlling the communication unit; Lt; / RTI >
The processor
A part or all of the changeable part of the code constituting the dynamic security module is designated as a variable,
Wherein a predetermined value is assigned to at least one of the variables, and a part or all of codes constituting the dynamic security module transmitted to the user terminal have a valid time.
11. The method of claim 10,
The modifiable portion of the dynamic security module includes a function name of a code, a variable designating an algorithm to be executed, a protocol field, a variable designating a protocol sequence, a variable designating a compile level, and a variable designating an execution code obfuscation method A dynamic security module generation device which is a code capable of changing at least one selected element.
11. The method of claim 10,
The processor
Generating a security session with the security client of the user terminal,
And sending the dynamic security module to the security client of the user terminal from which the secure session was generated.
13. The method of claim 12,
The processor
Further comprising: receiving a security management result from the dynamic security module transmitted to the security client, confirming the received security management result, and transmitting the security management confirmation result value to the dynamic security module of the security client, Generating device.
13. The method of claim 12,
The processor
And sending a stop command to the dynamic security module of the secure client to stop the application program of the user terminal when a security problem occurs in the user terminal.
13. The method of claim 12,
The processor
Generating a session ID as a secure session identifier, storing the session ID, and transmitting the session ID to the secure client so that the secure client stores the session ID, thereby generating the secure session.
13. The method of claim 12,
The processor
And to store parameters for each of the dynamic security modules transmitted to the secure client while the secure session is maintained.
13. The method of claim 12,
The processor
Further comprising verifying that the history transmitted from the security client is the same as the configuration of the parameters of the dynamic security module.
11. The method of claim 10,
Wherein the dynamic security module generation apparatus further comprises a storage for storing a dynamic security module to be transmitted to the security client of the user terminal, a session ID as a secure session identifier, and parameters for the dynamic security module.
A computer-readable recording medium on which a program for executing the generating method according to any one of claims 1 to 9 is recorded.

Images